CVE-2025-53367

Published Jul 3, 2025

Last updated 4 months ago

CVSS high 8.4
Ubuntu
Supply chain

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53367 is an out-of-bounds write vulnerability affecting DjVuLibre, a GPL implementation of the DjVu format, in versions prior to 3.5.29. The vulnerability lies within the `MMRDecoder::scanruns` method, which fails to properly validate the bounds of the `xr` pointer, potentially leading to writes beyond the allocated memory buffer. This can result in heap corruption. An out-of-bounds read with `pr` is also possible due to similar boundary checking issues. Successful exploitation of this vulnerability could allow an attacker to craft a malicious DjVu document that triggers heap corruption. This may lead to arbitrary memory writes, potentially enabling remote code execution, system compromise, or application crashes. Version 3.5.29 of DjVuLibre contains a patch that addresses this vulnerability.

Description
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
8.4
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-125

Social media

Hype score
Not currently trending

  1. #VulnerabilityReport #CVE202553367 CVE-2025-53367: DjVuLibre Vulnerability Opens Path to Linux Desktop Code Execution, PoC Available! https://t.co/xC2LRZryHS

    @Komodosec

    11 Aug 2025

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. URGENT: DjVuLibre vulns (CVE-2021-46310, CVE-2025-53367) in Debian 11 allow RCE via malicious files. ✅ Patch: sudo apt upgrade djvulibre-bin Read more:👉 https://t.co/CeLrzMneaN #InfoSec #CVE #SysAdmin https://t.co/q8oCKqMzWk

    @Cezar_H_Linux

    22 Jul 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre https://t.co/nDZXzP6GrE #GitHub #Git https://t.co/FXwth7Zqfi

    @lopezunwired

    7 Jul 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Linux環境で使用されるDjVu文書形式のデコーダ「DjVuLibre」に深刻な脆弱性（CVE-2025-53367）が発見された。MMRDecoder::scanrunsメソッドにおけるバッファ境界外書き込みが原因で、細工されたDjVuファイル（.pdfに偽装可

    @yousukezan

    5 Jul 2025

    595 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. A flaw (CVE-2025-53367, CVSS 8.4) in DjVuLibre allows remote code execution on Linux via out-of-bounds write. PoC is available; patch to v3.5.29 immediately. #DjVuLibre #LinuxSecurity #RCE #Cybersecurity #Vulnerability https://t.co/bMuwK2D2Dj

    @Daily_CyberSec

    5 Jul 2025

    271 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. #Linux: #DjVuLibre vulnerability CVE-2025-53367 could be exploited to gain code execution on a Linux Desktop system when the user tries to open a crafted PDF document. The POC works on a fully up-to-date Ubuntu 25.04 (x86_64): 👇 https://t.co/GHDLBY8iab

    @securestep9

    4 Jul 2025

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-53367: An exploitable out-of-bounds write that works on a fully up-to-date Ubuntu 25.04 https://t.co/4XP7K0juAV

    @Nosoynadiemas

    3 Jul 2025

    1851 Impressions

    10 Retweets

    30 Likes

    19 Bookmarks

    1 Reply

    0 Quotes

  8. CVE-2025-53367 DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is aff… https://t.co/eyzy7cPV05

    @CVEnew

    3 Jul 2025

    669 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.•CVE-2026-8933
  2. DD-WRT Stack-Based Buffer Overflow Vulnerability•CVE-2021-27137
  3. An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.•CVE-2026-11386
  4. The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.•CVE-2026-12375
  5. In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free.•CVE-2026-53359

References

Sources include official advisories and independent security research.